Introduction

So you have Snort up and running. If you think the work stops here, you're wrong. The purpose of setting up the IDS is not only to obtain data about network traffic (intrusion attempts, specifically), but to analyze this data and take action based on the results. Tuning of rules (described in Chapter 5, "Playing by the Rules") is done best when based on the live data from the current ruleset.

Try this as an exercise: Set up Snort on a rather busy network with the original set of signatures from the distribution package, and leave it to run as is for a while a week, for example. You will be surprised at how many alerts it will generate most probably hundreds, if not thousands. This enormous volume of alerts implies that you will not be able to obtain any general overview of what is going on in your network by simply browsing log files.

The important side of intrusion detection is that you probably want to not only register events, but also react to the intrusion attempts somehow in real time (more or less). Are you going to sit and scroll through ever-growing logs all day? Realistically, no. Better to have some application notify you of ongoing intrusion.

In this chapter, we look at four popular tools that can help you in both aspects of using Snort data consolidating/analyzing, and alerting people who deal with incident response tasks. These tools are:

• Swatch

• ACID

• SnortSnarf

• IDScenter

On the CD For your...